Event-driven-ansible: template injection via git branch and refspec in eda projects

The impact of CVE-2025-49521 is significant due to the ability of authenticated users to execute arbitrary commands on the EDA worker. This could lead to complete system compromise, data exfiltration, and disruption of automation workflows. In OpenShift deployments, the vulnerability presents a particularly severe risk, as attackers can potentially steal service account tokens, enabling lateral movement and privilege escalation within the cluster. The ability to access sensitive files further expands the attack surface, potentially exposing credentials, configuration data, or other confidential information. This vulnerability shares similarities with other Jinja2 template injection flaws, where improper sanitization of user input allows for code execution.

Organizations heavily reliant on Event-Driven Ansible for automation workflows, particularly those deploying Ansible Automation Platform within OpenShift environments, are at significant risk. Legacy configurations with permissive Git access controls and shared hosting environments where multiple users have access to the EDA worker are also particularly vulnerable.

• python / server:

import os
import subprocess
# Example: Check for suspicious Jinja2 template usage in EDA worker logs
with open('/var/log/eda/worker.log', 'r') as f:
    for line in f:
        if 'jinja2.Environment.from_string' in line:
            print(f'Potential Jinja2 template injection attempt: {line}')

• python / supply-chain: Monitor EDA worker processes for unusual command-line arguments or network connections. • generic web: Review EDA worker access logs for requests containing suspicious Git branch or refspec values.

1. 2025-06-30Disclosure

   disclosure

1. Reserviert2025-06-06
2. Veröffentlicht2025-06-30
3. Geändert2025-11-13
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-49521 is to upgrade to a patched version of Event-Driven Ansible as soon as it becomes available. Until an upgrade is possible, several workarounds can be implemented to reduce the risk. First, strictly restrict the allowed Git branch and refspec input to prevent malicious expressions from being injected. Second, review and minimize the permissions granted to the EDA worker to limit the potential impact of a successful attack. Consider implementing a Web Application Firewall (WAF) or proxy to filter potentially malicious requests. Regularly monitor EDA worker logs for suspicious activity, such as attempts to execute commands or access unauthorized files. After upgrading, confirm the fix by attempting to trigger the vulnerable Git operation with a known malicious payload and verifying that it is properly sanitized.